Nonce check causing issues when creating new post

Question

I have created a new custom post type and some custom fields for it. My function for saving the custom meta fields fires on the 'save_post' hook.

The problem is that I am getting a warning when I go to add a new post:

Notice: Undefined index: my_meta_box_nonce....

       // verify nonce
    if ( ! wp_verify_nonce( $_POST[ 'my_meta_box_nonce' ], basename( __FILE__ ) ) ) 
       return $post_id; 

When I enter the post details and hit publish the error is not displayed, it's only there when I create a new empty post. What's wrong here?

My code is almost identical and based on this tutorial: http://wp.tutsplus.com/tutorials/reusable-custom-meta-boxes-part-1-intro-and-basic-fields/

In the comments of that tutorial it seems that there were others who had the same problem, but there is no solution given.

Answer 1

I know that this is not the only tutorial that has code that check nonce for meta boxes but this is truly idiotic. Nonce should be checked per the whole action not per parts of it and if your save_post hook was called it means that the save nonce was already checked and found valid, so There is no need for more security checks.

My advice is to simply remove anything related to nonce from your metabox code, but if you will feel better having it around just change the code to

   // verify nonce
    if ( !isset($_POST[ 'my_meta_box_nonce' ]) || !wp_verify_nonce( $_POST[ 'my_meta_box_nonce' ], basename( __FILE__ ) ) ) 
       return $post_id; 

which will bail out when no nonce was supplied or the nonce failed validation